I think the point is that this is almost encouraged in the node ecosystem, while in most other language ecosystems I know of it wouldn't be.
node includes not everything and concentrate on the core. If modules have bugs, not all apps a compromised.
It is a fundamental design decision, if you not like it, don't use node.
You can include all dependencies manually and update them manually, nobody keeps you away. But have fun to update all your deps.
Maybe if you listen too much to twitter "thought leaders" you might get this impression, but we are all aware of the problems with social media platforms...